5

When I tried to log out by clicking the logout link at the top (first time for me because I don't really log out of S[OFU] unless I clear my browser's session data), I got the following message:

You're a registered user.

You can log in or out at any time using the OpenID you've already associated with your account.

And when I clicked on the parts of the site, it seems that I'm still logged in (see, i'm creating this question after I logged out and this question would probably appear in the list of the questions I asked) and my name is still appearing at the top of the page.

Is this by-design or is this a bug?

27

Have you clicked the Logout button below the message?

run rabbit, run!

| improve this answer | |
  • 6
    Oh, crap. – Randell Sep 14 '09 at 8:30
  • 2
    Hence, it's not intuitive enough. – Randell Sep 14 '09 at 8:31
  • Needs moar Paint. – random Sep 14 '09 at 8:32
  • 4
    This is the only site that requires me to click the logout link twice just to logout. – Randell Sep 14 '09 at 8:33
  • 1
    Yes, random, but I'm in a hurry. Could you add some monsters to it? – Ladybug Killer Sep 14 '09 at 8:37
  • Randell: Are you sure? ;) – Ladybug Killer Sep 14 '09 at 8:37
  • Yes. – Randell Sep 14 '09 at 8:44
  • Can you also add people that are pointing finger at it ? – Clement Herreman Sep 14 '09 at 8:48
  • @Clement H.: Hand of God ;) – Ladybug Killer Sep 14 '09 at 8:53
  • Exactly ! Fear the power of the hand ! – Clement Herreman Sep 14 '09 at 8:57
  • 3
    I love you, random :) – Ladybug Killer Sep 14 '09 at 9:06
  • 1
    Waffles! – Ladybug Killer Sep 14 '09 at 12:38
  • 4
    Cannot upvote any harder. – random Sep 14 '09 at 12:47
  • 3
    the "pew pew" makes this image – Jeff Atwood Sep 15 '09 at 3:26
  • 1
    My bank, and several other sites I use all do this confirm logout. My only comment is the message given here is a bit odd... I know I'm registered, or I wouldn't be logging out, I know I can log in and out, because I have done so at least once. – pipTheGeek Nov 1 '09 at 10:27
6

If you had a "no-touch", "no-confirm" logout, then you could be forcibly logged out at will by any user who can construct an <img> tag. How? I leave that as an exercise to the reader.

Hint: it's important! Almost web security 101!

| improve this answer | |
  • 1
    No points for you unless you explain yourself. – beska Sep 14 '09 at 17:19
  • 4
    Golly, even my non-web-dev brain can see the logic in this! Something like <img src="http://stackoverflow.com/logout.htm"></img>? – mmyers Sep 14 '09 at 17:27
  • Does that work? Hmm. Odd. – beska Sep 14 '09 at 19:13
  • 2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .